What is AI governance?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI governance is how an organization decides who may build, buy and use AI, for what, under which controls, and who answers when it goes wrong. In practice it is an inventory of AI systems, a way to rate their risk, policies and approvals scaled to that risk, human oversight where decisions matter, monitoring after launch, and a record that shows all of it happened.
What AI governance covers
People use the phrase for everything from a one-page ethics statement to a monitoring dashboard. We find it more useful to keep it practical. AI governance is the part of a company’s management system that controls AI, and it should be able to answer six questions about every AI system you run.
- What is it, and who owns it? An inventory with a named owner for each system, vendor tools included.
- How risky is it? A classification that looks at what the system decides or does, who it affects and how much it acts on its own.
- What may it do? Policies, approved uses and limits, decided by someone accountable, not by the team that built it.
- Who checks it? Independent review before use, scaled to the risk.
- Is it still working? Monitoring for drift, errors, bias and misuse, with a path to escalate.
- Can we prove it? A record of decisions, reviews and incidents that an auditor or regulator can check.
Why AI governance matters now
Three reasons, roughly in the order boards notice them. AI has moved out of the lab and into decisions about customers and money. A lot of it shows up inside software you already bought, often switched on by an update nobody reviewed. And regulators have started asking pointed questions: the EU AI Act sets duties for high-risk uses like credit scoring; in Canada, OSFI’s E-23 pulls AI models into model risk management from 1 May 2027, and its July 2026 bulletin covers AI agents; Quebec’s AMF has its own AI guideline starting the same day.
There’s a plainer reason too. An organization that can’t say which AI it runs can’t answer a customer complaint, an incident or a vendor outage quickly.
What an AI governance framework looks like
Most frameworks share a structure, whatever they call the parts:
| Building block | What goes in it |
|---|---|
| Principles and policy | What the organization will and will not use AI for; the risk appetite; the policy that applies it. |
| Roles and accountability | Board oversight, a senior owner of AI risk, system owners, independent reviewers, and who approves what. Often an AI committee. |
| AI inventory | Every AI system and model, in-house and vendor, with its owner, purpose, data and risk tier. |
| Risk classification | Tiers that decide the depth of review, testing and oversight each system needs. |
| Lifecycle controls | Requirements at design, data, development, testing, approval, deployment, change and retirement. |
| Human oversight | Where a person must review or approve an AI output or action, and how they can stop it. |
| Third-party AI | Due diligence, contract terms and monitoring for AI bought from vendors. See third-party AI. |
| Monitoring and incidents | Metrics, thresholds, incident handling and reporting. |
| Records and assurance | Evidence of every decision, and internal audit of the framework itself. |
The main AI governance frameworks
| Framework | What it is | Binding? |
|---|---|---|
| NIST AI RMF | US voluntary framework: Govern, Map, Measure, Manage. | Voluntary |
| ISO/IEC 42001 | International standard for an AI management system; can be certified. | Voluntary, certifiable |
| EU AI Act | EU regulation with risk tiers and obligations for high-risk AI. | Law in the EU, with reach beyond it |
| OSFI E-23 | OSFI’s model risk guideline, covering AI models. | Supervisory expectation for Canadian FRFIs from 1 May 2027 |
| OSFI AI bulletin | Sound practices for generative and agentic AI in technology, cyber and resilience. | Sound practices, building on B-13, E-21, B-10 |
| AMF AI guideline | Quebec’s guideline on the use of AI by financial institutions. | Supervisory expectation in Quebec from 1 May 2027 |
They aren’t alternatives. A Canadian bank typically meets OSFI’s expectations, borrows structure from NIST or ISO, and checks the EU AI Act for anything it offers in Europe.
Where to start
- Name a senior owner of AI risk and the committee or person who approves high-risk uses.
- Build the inventory first, vendor AI included. Most organizations find more than they expected.
- Set three or four risk tiers and decide what each tier requires before use.
- Put the riskiest systems through independent review and record the approvals.
- For AI agents, write down what each may do and require a person for high-impact actions; see agentic AI governance.
- Keep the record as you go, rather than reconstructing it before an audit.
MINERVA is AI governance software for Canadian banks and insurers: one record for AI models, agents and vendors, with approvals enforced and evidence an examiner can verify. Our buyer’s guide lists twelve questions to ask any vendor, us included.
Related questions
What is the difference between AI governance and AI ethics?
AI ethics sets out values, such as fairness and transparency. AI governance is the machinery that makes those values happen: owners, policies, reviews, approvals, monitoring and records.
What is an AI governance platform?
Software that keeps the AI inventory, risk ratings, reviews, approvals, monitoring and incidents on one record, and in some cases enforces policies on AI agents at run time.
Who is responsible for AI governance?
The board oversees it and a senior executive owns AI risk. System owners are accountable for their AI, independent reviewers challenge it, and internal audit tests the framework.
Is AI governance a good career?
It is a growing field that draws on risk management, law, data science and security. Certifications such as the IAPP’s AIGP and knowledge of ISO/IEC 42001 and the EU AI Act are common entry points.
Does AI governance slow down AI adoption?
Done well, it speeds it up: clear tiers let low-risk uses go ahead quickly and focus scrutiny where it matters.
Sources
- NIST — AI Risk Management Framework (AI RMF 1.0)
- ISO — ISO/IEC 42001:2023 Artificial intelligence management system
- OSFI — Guideline E-23, Model Risk Management (2027)
- EUR-Lex — Regulation (EU) 2024/1689, the AI Act
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.